Forest Global Training Partners

Cyber Risks · Krebs on Security

FBI Seizes Net Nut Proxy Platform, Popa Botnet

Summary: The FBI, working with the IRS Criminal Investigation division and partners including Google, Lumen and Shadowserver, seized hundreds of domains tied to NetNut, a residential proxy service run by publicly-traded Israeli firm Alarum Technologies, roughly two weeks after security firms linked NetNut to the Popa botnet of at least two million compromised devices. Google's Threat Intelligence Group said it observed 316 distinct threat actor clusters using suspected NetNut exit nodes in a single week in June 2026, and reported disabling Google accounts and apps used for malware command and control.

What you should know: Google says the action cut the device pool available to the proxy operator by millions, but also warns that operators rebuild by reselling competitors' capacity - as IPIDEA did after its own takedown - so the ecosystem, not one brand, is the target. Alarum's stock fell roughly 67 percent in a week to $2.62 a share, a reminder that the proxy traffic ran through consumer devices in homes, not data centers.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related